n�>A(�x��-z���Po��$m|W�����`��F�^����������qr�2|\���\Dk���n� pl�D[�a��������a ��H��H҅ϖ�-Tt�2r6nڋ?�yx���T��"���u�����1����>NLso�L��[e\0w�M@ ��O�{6�(_*��A��̽������w_㬺����2o�ʨ\���ӈ��7�J��7��*��$�e9�o���Ɂ-F'm���K� �N�a�d�;2 ��*}�0E�G�PO�u���ã���fO���^P1f�[c�;�0Fj a�n����QE�Ɍ����|�S:Pt!�.Yۥ������V�Z3An�J�1�&q�vHYx��_�sM$Q�~o<}8ug֓Lrx�=ʏ�v=s�yF�F"|�����uO#3Ŏ垊��qYu0���)E���eK�_���=�r��:�u9-���DG�'�~�?a��k��KS����]SùA����D�5$87������R��NʫNQ��`S J��Z_�ƧJ��g>�=�4h�7�w����h����Og��a�W#{�$tA�QT&�r���m�o� �#J��6���4�~���K����!�E��,�˕�0X�����5~����E���-d7z�.J8)b�H���j?5*���"n� �j���hh�?����BZ���>٨��?eڈ�M�A��=�M��yH�b���7,����O��4d5!5��Y03�,���q;ܹ%�C��9�ߥ{���@&Voe���Q@hV�R3�M4��{�I�?������<E�%^����-fF�z����@rO�1�+"�e�����1���_�_������ݖ0WK�������� ��M���Oe�e�xM�M斬��- ���y��x1�O�3�"))��#�ܼRm�%�S[�[�����i��_X�i<_=�dLZCzD�n��R$h��4�lП�s��C%Ԍ��IRWcb�J����H�BquI��HȬ�ac`.Ȱ�`é��܍��0#h�[ ���f�� C�#u>tlN�������l3�� 1��^��=���+Ӗ��{,ڴ�d��Y�c��$����J�lw�u�up?�ƕMa:�oN|~�3x���|E�� a��[Z�3P�_hYyʠ���}�yř� ����Ŋ)z� 1ں*W��X�z�0�S���p�����)G�=klb��S� �����P 6��q���*�\��T�Qd&2�?��F_OVy�W�;���K��a�Y�!���:�����hqy����ܺ�t�&�}��0b_�Q�_f�1��,��d� �Y �YUx�?�=��*0ٷM�ψ�>ٔ�u��EU�q�0�6����� �_�j�����8�%��fV��\-�Oק�-��K;ԟ��F�0Q�i���Xg�������^2�Rh�"TY�)3_���q�Y] S��B�91��Ù�Zx�D���QH�L�R�ڜq���xo� ����w�(ݯ�������r|��Ըh�^������%RsM��� �����kn�����ulː�F��p %�0X��&�+�tg�mb���yZ���������h�Xg�@���n*�2{z,��Fډp�nU�ݪ��r`7.Oio6��g��u�h���$g���� �s�BD9WR �g�-�;�1$d#{ԁSB �)�(Y��ႛW/U���;��R�txF���I��e�KMs�?$�6�n��>�rH��D1��ݐZM"g����3��_1nz�lD�T�I�6��.f/�h�ƛ�*�q������Q��t�i#�AL��X��!Ԓ���gy_c$�OP9Ն ��L��1Ç�� ���/����qר�&��jNM&0f�`�Yn는�։�^է64tQ��VdL�"2~�$jݣ;�J�v^IV��u0��x-!ݠ����@����*���X`G�����"λ��se��k���TJe�Մ�!A=�����|�u MI ���E-�س6z�o'H��\�*gZ1�p'�t�B�5�,Dp��A���90:�>�ߠX��AUɮ��'Xt�t��oT#��˄�(�a�\�*N�d��嵐���A҆3�m���0�ޅ�ܺ�Si�N:Ph�F4`�����Q��[9�nu� h��V��Fb��b��hNK� �s�������L5�-�74�ğW5�Ë0���0A��K�D��گF�&9������LV��Kl��6d���rE9�ۀS������CIz�^(j��h�����:���ղ��f⎲�{���cL��q�U�#z���7G���������L8�z�"7���6��~V�&e�s/O81�ח����_e�q9@�Vq����%d��ıh{)<U�q�n�&�` ��(; �m�H@FՃ�0�0gD�"�dQ�p+:1K(\�� �����j7������e���C� Yc����+����aLE,�0���b��o�p ;�i��wl:)2`�&��]����5.kn�1B����p���(↧ƈyo ޢmB��}�~U�u[�,&��1�@���z%��[I�!��v�\��$�P ��Lv6���H}m^KZ��Rά�X��dv�Z��J��^#Ԕ{4A���;�7ʓN���O�G����x�Y�ެ��!��� S_����@<V�}a�US�Ӫ$7M�5`��v����rBh�XJ��`��гy��`R%�l�� n��KT���!�C]���6 �.g��D$�l=��� ?d�����s~������H�AW����ґgߤk���������6�YM�B���ؐ����4e�o����+;N�ey�����eU�x�jjW�r�o�p;y�"���ʍʘ�A����j�Ԑhl��ɇ�岛m ��qOn1a?A�ȳ`��{�pb��!`��Q|����G�7��B��^��}�C`Ot��{����\���x�m��0���x��`?�Q���9Of�@���4�>����N� l�is�I�c挎�[��&&XX��J��O��n��ӑ�o��GN���v�R���q��3����&c"�<Be
Static task
static1
Behavioral task
behavioral1
Sample
5cac09eba719de5f56d1e0cf97d66e60711ec9b70e89a024ab8578971a069707.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
5cac09eba719de5f56d1e0cf97d66e60711ec9b70e89a024ab8578971a069707.exe
Resource
win10v2004-20221111-en
General
-
Target
5cac09eba719de5f56d1e0cf97d66e60711ec9b70e89a024ab8578971a069707
-
Size
7.4MB
-
MD5
951d76b81e6e2ce54963fd342b116881
-
SHA1
435610c043da4b194f50949178e3c049e50d881c
-
SHA256
5cac09eba719de5f56d1e0cf97d66e60711ec9b70e89a024ab8578971a069707
-
SHA512
e7a10602723fb7d51efbb8b024550d55f8a30d27cb2f370c6c982aba6416fa766e2b44b0ef528711dd76c09181ab68ba33c4d703087a6920e71466d56a6d62d2
-
SSDEEP
196608:bj8ktn/6Ludw7UOo6E2nd8sUkJiSI2RbK:Mkt327UOokC9WiS11
Malware Config
Signatures
Files
-
5cac09eba719de5f56d1e0cf97d66e60711ec9b70e89a024ab8578971a069707.exe windows x86
fcd1bb3b6051d49ece0b889233b80164
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetVersionExA
GetVersion
GetVersionExA
GetVersion
CreateFileA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
ShowScrollBar
advapi32
ControlService
oleaut32
SysFreeString
version
GetFileVersionInfoA
gdi32
StartDocA
ole32
OleUninitialize
comctl32
ImageList_SetIconSize
winspool.drv
EnumPrintersA
shell32
SHFileOperationA
wininet
InternetCloseHandle
urlmon
CoInternetCreateSecurityManager
comdlg32
FindTextA
wsock32
gethostbyname
oledlg
OleUIObjectPropertiesA
crtdll
isprint
Exports
Exports
Sections
CODE Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 16KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
jagxcnag Size: - Virtual size: 7.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
jagxcnag Size: 7.4MB - Virtual size: 7.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 31KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ